nandi/frq · README.md

nandi/frqpublic⑂ Fork 0

⑂ 5581b0fb0907d4a9498e17399d68ff8dbc383216

README.md · 35 lines · 1.6 KBmarkdown    Blame HistoryRaw
CI builds the image, Modal serves it   1
The registry it pushes to is the one it has   3    FRQ_WEB_IMAGE=registry.rickub.com/nandi/frq-web:<sha> \
CI builds the image, Modal serves it   4        modal deploy .modal/web/container.py
6Defined by `container.toml`; `../_loader.py` is what reads it, and
7its comments are the spec.
The registry it pushes to is the one it has   9Unlike `dev`, this container builds nothing. rickub builds the image
10-- `Dockerfile` here, two stages, the second one just the bundle and
11a python -- and pushes it to `registry.rickub.com`; this deploys that
CI builds the image, Modal serves it   12exact tag. So the thing served is the thing that was built and
The registry it pushes to is the one it has   13tested, and a deploy is a pull rather than a compile. The workflow is
14`.rickub/workflows/web.yml`.
CI builds the image, Modal serves it   15
16`runtime = "web"`: a Function whose [run] command listens on the one
17[network] port, fronted by a stable https URL. `modal deploy` leaves
18it up, and deploying again replaces it in place because the app is
19named by `[container] name`.
Nothing to guard, so no credential to keep   21One credential and one setting live outside the repo, both one-time:
CI builds the image, Modal serves it   22
The registry it pushes to is the one it has   23* `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET`, as rickub repository
Nothing to guard, so no credential to keep   24  secrets. The registry needs none of its own -- rickub authenticates
25  docker before a workflow's first step.
26* The image set to **public** on rickub: its detail page, Manage,
27  visibility. Private is the default, and the first push creates it
28  private, so this is done once after the first green run.
The registry it pushes to is the one it has   29
Nothing to guard, so no credential to keep   30The second is why there is no `registry_secret` in `container.toml`.
31Modal pulls on every cold start rather than once at deploy time, so a
32private image would want a long-lived rickub deploy token held as a
33Modal Secret -- and what it would be guarding is `build/web`, which
34the URL hands to anyone who opens it. The alternative is written down
35in `container.toml` for whoever wants it.

CI builds the image, Modal serves it 5693bd5 nandi 10h ago	1	# `web`
CI builds the image, Modal serves it 5693bd5 nandi 10h ago	2
The registry it pushes to is the one it has 627b785 nandi 10h ago	3	FRQ_WEB_IMAGE=registry.rickub.com/nandi/frq-web:<sha> \
CI builds the image, Modal serves it 5693bd5 nandi 10h ago	4	modal deploy .modal/web/container.py
	5
	6	Defined by `container.toml`; `../_loader.py` is what reads it, and
	7	its comments are the spec.
	8
The registry it pushes to is the one it has 627b785 nandi 10h ago	9	Unlike `dev`, this container builds nothing. rickub builds the image
	10	-- `Dockerfile` here, two stages, the second one just the bundle and
	11	a python -- and pushes it to `registry.rickub.com`; this deploys that
CI builds the image, Modal serves it 5693bd5 nandi 10h ago	12	exact tag. So the thing served is the thing that was built and
The registry it pushes to is the one it has 627b785 nandi 10h ago	13	tested, and a deploy is a pull rather than a compile. The workflow is
	14	`.rickub/workflows/web.yml`.
CI builds the image, Modal serves it 5693bd5 nandi 10h ago	15
	16	`runtime = "web"`: a Function whose [run] command listens on the one
	17	[network] port, fronted by a stable https URL. `modal deploy` leaves
	18	it up, and deploying again replaces it in place because the app is
	19	named by `[container] name`.
	20
Nothing to guard, so no credential to keep 5581b0f nandi 10h ago	21	One credential and one setting live outside the repo, both one-time:
CI builds the image, Modal serves it 5693bd5 nandi 10h ago	22
The registry it pushes to is the one it has 627b785 nandi 10h ago	23	* `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET`, as rickub repository
Nothing to guard, so no credential to keep 5581b0f nandi 10h ago	24	secrets. The registry needs none of its own -- rickub authenticates
	25	docker before a workflow's first step.
	26	* The image set to public on rickub: its detail page, Manage,
	27	visibility. Private is the default, and the first push creates it
	28	private, so this is done once after the first green run.
The registry it pushes to is the one it has 627b785 nandi 10h ago	29
Nothing to guard, so no credential to keep 5581b0f nandi 10h ago	30	The second is why there is no `registry_secret` in `container.toml`.
	31	Modal pulls on every cold start rather than once at deploy time, so a
	32	private image would want a long-lived rickub deploy token held as a
	33	Modal Secret -- and what it would be guarding is `build/web`, which
	34	the URL hands to anyone who opens it. The alternative is written down
	35	in `container.toml` for whoever wants it.